Google and FBI Disrupt NetNut Network Believed to Use Millions of Infected Devices

Summary

Google says a joint effort with the FBI and partners significantly degraded NetNut, a residential proxy network believed to involve more than 2 million infected Android devices and used by threat actors.

Key points

NetNut, also known as Popa, is believed to include more than 2 million Android devices infected through trojanized apps and malware such as Badbox 2.0.
Google observed 316 distinct threat clusters using NetNut in one June week to mask their locations during password-spray attacks and access victim environments.
Google disabled accounts and services used for command-and-control and blocked infected apps through Google Play Protect, which also warned affected users.
Google said its actions significantly degraded the network and reduced its available device pool by millions; the article does not report that the network was fully dismantled.
Google said the operator also resold proxy access through a white-label program, and argued that disruption requires targeting interconnected providers.

Article Details

Event Type: Coordinated disruption of the NetNut residential proxy network and its botnet backend infrastructure.
Impact: Google, the FBI, and other organizations coordinated actions against NetNut. Google said the actions significantly degraded the network and reduced the available device pool by millions. Google also disabled accounts and services used for command and control, disabled infected applications through Google Play Protect, and warned affected users. Google reported that more than 2 million Android devices were believed to be part of the network and that 316 distinct threat clusters used it during one week in June for location concealment in password-spray attacks and to access victim environments.